BIOC
Informational
✕
Windows Task Manager being disabled via Registry
Task manager may be disabled to tamper with the user experience and with the response to a malicious incident.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Tampering
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
Indicator:
Registry action type = all AND registry data = 1 AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Policies\System AND registry value name = DisableTaskMgr Host host os = windows
Preventable: yes